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IN THE CLAIMS 

Please cancel claims 1-8 and add the attached new claims 9-16. 

REMARKS 

Prior to a formal examination of the above-identified application, acceptance of the 
new claims and the enclosed substitute specification (under 37 CFR 1.125) is respectfully 
requested. It is believed that the substitute specification and the new claims will facilitate 
processing of the application in accordance with M.P.E.P. 608.01 (q). The substitute 
specification and the new claims are in compliance with 37 CFR 1.52 (a and b) and, while 
making no substantive changes, are submitted to conform this case to the formal 
requirements and long-established formal standards of U.S. Patent Office practice, and to 
provide improved idiom and better grammatical form. 

The enclosed substitute specification is presented herein in both marked-up and 
clean versions. 
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The undersigned, an agent registered to practice before the Office, hereby states 
that the enclosed substitute specification includes the same changes as are indicated in 
the marked-up copy of the original specification. It does not contain new subject matter. 
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A method and device for monitoring signal processing units for sensors 

BACKGROUND OF THE INVENTION 

[0001] The invention relates to a method and a device for monitoring signal processing 
units for sensors which detect the individual process control quantities or process meas- 
ured values of a process. 

[0002] Electronic stability programs are driving dynamics control systems for vehicles that 
serve to support the driver in critical driving situations during braking, accelerating and 
steering, and to intervene in cases where the driver himself has no possibility of interven- 
ing directly. The control system supports the driver during braking, particularly on a 
roadway with a low or changing friction value, on which the vehicle can no longer be con- 
trolled because of locking wheels, or could begin skidding upon accelerating, whereby 
there is a danger of the drive wheels spinning, as well as, finally, during steering on a 
curve during which the vehicle could oversteer or understeer. On the whole, not only the 
comfort, but also the active safety, is thereby significantly improved. The basis for such a 
control system is formed by a closed control circuit which, during the normal operation of 
the vehicle, assumes typical control tasks and, during extreme driving situations, is in- 
tended to catch the vehicle as quickly as possible. Sensors for the determination of the 
different driving dynamics parameters are, as the actual value transmitters, thereby par- 
ticularly important. A plausible control presupposes that the sensors correctly reproduce 
the actual condition of the control system interval. This is particularly important during 
driving stability control actions in extreme driving situations, in which a deviation from 
control must be fully stabilized within a very short time. For this reason, the sensors in an 
electronic stability program (yaw rate sensor, lateral acceleration sensor, and steering 
angle sensor) must be monitored continuously. A corresponding online-sensor monitor- 
ing has the purpose of detecting errors in the sensors at an early stage, so that an error 
in control that could bring the vehicle into a safety-critical condition is ruled out. 
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[0003] The ESP systems that are in serial production at the present time use a multiple 
sensor ("sensor cluster") for the determination of the rotational rate of the vehicle, as well 
as of the lateral and the longitudinal acceleration, if necessary. This sensor is placed in 
the passenger space and communicates with the ESP control device by way of a CAN 
interface (WO 99/47889). 

[0004] Future applications (such as the ESP 2 or active front steering AFS, for example) 
even use the signals of the sensor cluster to influence the steering. Since steering inter- 
ventions entail significantly higher risks than braking interventions, greater demands are 
also placed on the reliability of the sensing technology. Redundant systems, which can 
recognize error functions independently and react correspondingly, are required. 

[0005] Figure 1 depicts a known sensor cluster in a redundant design. The rotation rate 
sensor (11, 12) and the acceleration sensor (1, 2) are thus present twice. The signal 
processing is carried out in a commonly used set of chips. The A/D transformers (ADC 1 
and ADC 2) and the processor core (//C1, ijCT) are thereby designed redundantly, while 
the signal paths (13, 14) (such as the SPI interface between the transformers and proc- 
essors, reception register, etc., for example) are only present once, however. Defective 
sensor elements, as well as errors in the program design, can thus be detected. 

[0006] It is disadvantageous, however, that errors are not detected on the transmission 
path between the A/D transformer (ADC) and the processor, just as errors in the A/D 
transformer itself (such as partial bits, for example), which lie within the order of magni- 
tude of the permissible signaling precision, are also not detected. 

[0007] The task that forms the basis for the invention is thus that of creating a method 
and a device for monitoring the signal processing of sensors of the type stated above 
that has the reliability that is necessary, particularly for driving stability control and/or 
comfort control during active steering interventions for vehicles. 
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SUMMARY OF THE INVENTION 

[0008] This task is solved , in accordanc e w i th c l aim 1, by means of a method of the type 
stated above, which is characterized by an at least redundant processing of the sensor 
data in two identical signal processing units, which are each evaluated and checked for 
plausibility, independently and separately from one another, by means of at least two 
processing devices in two evaluation devices, whereby the sensor data are transmitted 
between the one processing device and the one evaluation device through separate sig- 
nal lines. 

[0009] It is advantageous that, in every evaluation device sensor, the data that are sepa- 
rately evaluated and checked for plausibility are exchanged by way of an interface be- 
tween the evaluation devices. The sensor data and the condition information of the spe- 
cific other evaluation unit that have been evaluated and checked for plausibility are 
thereby sent to a superordinate control device of the vehicle by each evaluation device, 
independently of the other one. 

[0010] The transmission of the sensor data and the condition information that have been 
evaluated and checked for plausibility to the other evaluation unit is carried out, by way of 
internally separate signal lines, to one data bus and the control device of the vehicle. 

[0011] This task is additionally solved , i n accordanc e w i th c l aim 5, with a device of the 
type stated above, which is characterized by at least two identical signal processing units 
for the redundant processing of the sensor data, with at least two processing devices and 
two evaluation devices, in which the sensor data are evaluated and checked for plausibil- 
ity independently of and separately from one another, whereby one processing device is 
connected with the one evaluation device by way of separate signal lines, and the sensor 
data are transmitted between the one processing device and the one evaluation device 
by way of the separate signal line. 
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[0012] Advantag e ous further d e v el opm e nts of th e i nv e nt i on ar e stat e d i n th e sub c l a i ms. 



[001 3] The following advantages result from the invention: 

• Completely redundant -signal path all the way to the signal output. All errors ap- 
pearing in the system can be detected. 

• Prevention of a loss of comfort from a premature system activation caused by er- 
rors that are still within the framework of the range specified. 

• Suitability for highly sensitive systems with very low control thresholds. 

• Cost savings through the use of components identical to the non-redundant stan- 
dard sensor cluster. No special components (such as double core processors, for 
example) are necessary. 

[0014] Examples of implementation of the invention are depicted in the diagrams, and 
are described in further detail in the following. 

BRIEF DESCRIPTION OF THE DRAWINGS 

[0015] These depict the following: 

[0016] Figure 1: A simple redundant sensor cluster in accordance with the 
state of the art; 

[0017] Figure 2: A schematic representation of the structure of an ESP sys- 
tem; 

[0018] Figure 3: A completely redundant sensor cluster in accordance with the 
invention. 
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DETAILED DESCRIPTION OF THE DRAWINGS 

[001 9] The process of auto driving can be considered, in accordance with Figure 2, in a 
technical control sense, as a control circuit in which a driver (1) represents the control 
unit, and a vehicle (2) represents the control system. The control inputs are thereby the 
personal driving wish (FW) of the driver, which he determines through the continuous 
observation of the road traffic. The actual values (IF) are the current values for the direc- 
tion and speed of travel, which the driver determines by means of his sight or driving 
sensations, as the case may be. The control variables (SF) are, finally, the steering 
wheel angle, the position of the transmission, as well as the positions of the gas and 
brake pedals, which are determined by the driver on the basis of the deviations between 
the theoretical and the actual values. 

[0020] Such a type of control is frequently made more difficult by disturbances (S), such 
as changes in friction values, irregularities in the roadway, lateral wind, or other influ- 
ences, since the driver cannot precisely detect these, but still must take them into con- 
sideration during the control, however. For this reason, the driver (1) can, to be sure, 
generally manage the tasks conveyed to him - that is to say, controlling and observing 
the process of driving the auto under normal driving conditions — on the basis of his train- 
ing and accumulated experience without difficulties. Under extreme situations and/or un- 
der the extraordinary driving conditions noted, under which the physical friction bounda- 
ries between the roadway and the tires are exceeded, the danger does exist, however, 
that the driver will react too late, or incorrectly, and will lose control of his vehicle. 

[0021] In order to be able to take even these driving situations into account, the driving 
dynamics control system is supplemented by a subordinate control circuit (ESP) which, in 
accordance with Figure 1 , comprises a control algorithm (4), a system monitoring unit (5), 
and an error memory (6). Measured driving condition values are thereby transmitted to 
the system monitoring unit (5) and to the control algorithm (4). The system monitoring 
unit (5) produces an error message (F), if necessary, which is transmitted to the error 
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memory (6) and to the control algorithm (4). The control algorithm (4) then acts on the 
vehicle (2) in dependence on the control variables produced by the driver (1). Typical 
control tasks are carried out with this control circuit. Under extreme driving situations, the 
vehicle can be caught again as quickly as possible. 

[0022] Figure 3 depicts the structure of such a control circuit, which essentially comprises 
an anti-blocking system (10), a drive skidding control (11), and a yaw momentum control 
(12). The system can be supplemented by a steering angle control not depicted in further 
detail, such as is described in WO 2004/005093, for example. In addition, yaw rate sen- 
sors (13), lateral acceleration sensors (14), a steering angle sensor (15), a pressure sen- 
sor (16), and four wheel speed sensors (17) are provided, which are used both as actual 
value transmitters for the determination of the control deviation, as well as for the forma- 
tion of a yaw rate theoretical value and various intermediate values. 

[0023] The process control inputs produced by the driver (1) through the activation of the 
gas and brake pedal, as well as the steering wheel, are added to the drive skidding con- 
trol (11), the anti-blocking system (10), and the pressure sensor (16), as well as the 
steering angle sensor (15), as the case may be. Vehicle-specific non-linearities, fluctua- 
tions of the friction values, lateral wind influences, etc., are summarized as disturbances 
or unknown values (18) and influence the longitudinal and lateral dynamics of the vehicle 
(19). This dynamic (19) is, furthermore, influenced by the control inputs noted, as well as 
by the output signals of an engine management unit (20), and acts on the wheel speed 
sensors (17), the yaw rate sensors (13), the lateral acceleration sensors (14), as well as 
the pressure sensor (16). A control arbitration unit (21), to which the output signals of the 
anti-blocking system (10), the drive skidding control (11), the yaw momentum control 
(12), the steering angle control, and a braking intervention algorithm (22) are transmitted, 
serves for the distribution of priorities to these signals in relation to their effect on the en- 
gine management unit (20), or directly on the driving dynamics (19). The braking inter- 
vention algorithm (22) is thereby influenced by the yaw momentum control (12) and the 
pressure sensor (16). Finally, a driving condition detection unit (23) is provided, to which 
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the signals of the steering angle sensor (15), the yaw rate sensors (13), the lateral accel- 
eration sensors (14), as well as the wheel speed sensors (17) are transmitted, and the 
output signals of which influence the yaw momentum control (12) as well as a single- 
track reference model (24), by means of which a theoretical yaw rate desired or the 
steering angle is produced. 

[0024] The sensor cluster (40), with a completely symmetrical redundancy of the signal 
processing units (43, 31, 46 and 44, 32, 45), is depicted in Figure 4. The sensor cluster 
(40) consists of two identical separate paths for the signal processing. The rotation rate 
sensor (41, 42) and the acceleration sensor (21, 22) are present twice. The sensors (41, 
42, 21, 22) and the signal processing units (43, 31, 46 and 44, 32, 45) are preferably po- 
sitioned in a common casing (62). Two signal processing devices (43, 44), such as an 
analogue-digital signal transformer, which convert the analogue output signal of the sen- 
sors into a digital input signal, are assigned to them. Two evaluation devices (31, 32), 
such as identical microcontrollers, digital signal processors (DSP), or programmable logic 
modules, particularly ASIC's, are used for the signal processing. The sensor data are 
transmitted between the one processing device (43, 44) and the one evaluation device 
(31, 32) by way of a separate signal line (60, 61). The signals, which are now present in 
digital form, are processed in the evaluation devices (31, 32) in digital form. The evalua- 
tion-related sensor signals are applied to the output side of the evaluation devices (31, 
32). These are supplied to the serial vehicle communication bus (47) by way of the two 
CAN controllers (45, 46) provided in the evaluating devices (31, 32). The evaluation de- 
vices (31, 32), which are connected with the integrated CAN (controller area network) by 
way of the separate lines (71, 72), thereby assume the following system functions: 

• Preparation of a driver signal / driver voltage for the activation of the electrical- 
mechanical transformer of the rotation rate sensor (41 , 42). 
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• Reception of the signals of the rotation rate sensor (41, 42) with specific algo- 
rithmic allocations and filtering in order to obtain a numerical value for the yaw 
movement of a vehicle. 

• Conversion of the numerical values of the yaw movement of a vehicle into the 
CAN and transfer to the serial bus (47). 

[0025] These evaluation devices (31, 32) can correspond precisely to the components 
used in the known sensor cluster (such as EP 1 064 520 B1, for example) - that is to 
say, no special components are then needed for this system. 

[0026] The outputs of both of the signal processing units (43, 31, 46; 44, 32, 45) can be 
joined in the sensor cluster (40), or else they can be connected, in separate lines (49, 
50), with the vehicle communication bus (here: CAN). In the event of a joining in the sen- 
sor cluster, the interface remains compatible with the existing system. 

[0027] Each of the evaluation devices (31, 32) has access to all of the sensor data, and 
carries out a signal processing and plausibility evaluation independently of the others. It 
reports the result of its plausibility evaluation and of its computations, if applicable, to its 
partner by way of an appropriate interface (48). 

[0028] Each of the evaluation devices (31, 32) thereupon sends a communication (here: 
CAN message) to the (ESP) control device independently of the others. This communi- 
cation contains, in coded form, the specific data, the status of its own plausibility evalua- 
tion, as well as the condition signaled by the partner. 

[0029] The control device decides, in dependence on the status flags contained in the 
communications, whether the data are to be evaluated as valid, as conditionally valid, or 
as incorrect. Conditionally valid data can be evaluated through comparison with other 
values, such as with the wheel speeds, for example, by means of the model: 
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- and are additionally used, if necessary. (S) is hereby the lane width of the vehicle, (v vr ) 
is the wheel speed, front right, and (v v i) is the wheel speed, front left. Thus, in the event 
of a failure of a yaw rate signal, such as during an ESP control of the control device, for 
example, the intact signal can be identified and used to continue the control by means of 
the available model data. 

[0030] In terms of expense, this solution corresponds to two separate identical sensor 
clusters. It has the advantage, however, that each cluster can have access to the sens- 
ing technology of the other one. Additional information is made available by this means. 

[0031] The redundancy concept illustrated here in the example of a sensor cluster can be 
applied to any other sensor systems desired. Thus, the following variations, which are 
jointly included in the invention, are conceivable: 

• The use of n > 2 signal processing units (43, 31, 46), which access the signals of 
any desired number of sensors (41, 42, 21, 22), a portion of which may be redun- 
dantly present, but which do not have to be, however. 

• Redundant sensors (41, 42) may be present in double form or in multiple form (> 
2). With three or more sensors, a decision can be made as to which sensor is de- 
fective, even during the signal processing. 

• The sensors (41, 42, 21, 22) and the signal processing units (43, 31, 46; 44, 32, 
45) do not have to be located in the same casing (62). 

• The connection (63-70) of the sensors to the signal processing units may be car- 
ried out by analogue or digital means. 
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• The connection of the signal processing units (43, 31, 46; 44, 32, 45) to the su- 
perordinate control device may be carried out by analogue or digital means. 

• The signal processing units (43, 31, 46; 44, 32, 45) exchange status information, 
computation results, or even no information at all. 

• The signal processing units (43, 31 , 46; 44, 32, 45) can carry out different tasks at 
different times (such as during the initialization phase or during self-diagnosis, for 
example). 

• Not every signal processing unit (43, 31, 46; 44, 32, 45) has to evaluate all sensor 
signals, but even partially redundant systems are possible. 

[0032] In the event that a superordinate system is not acceptable, there is the advanta- 
geous form of implementation of only allowing one signal processing unit (43, 31, 46; 44, 
32, 45) to communicate actively. The other one(s) initially remain(s) passively in the 
background, but nevertheless carry out the checking for plausibility with the correspond- 
ing internal communication, however. It is only if a discrepancy has been determined 
there that the passive signal processing units carry out a veto and actively report to the 
superordinate system. If realized in practical terms, this could appear as follows: 

The signal processing units (43, 31, 46) and (44, 32, 45) are identical, but have a 
software coded by means of a PIN number, however, which makes two types of 
operation possible. 

The signal processing unit (43, 31, 46) works as a master (coding 1) and sends 
the result of its evaluation to the CAN. 
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[The] signal processing unit (44, 32, 45) works as a slave (coding 0) and com- 
pares the result of the master received through the CAN with its own computa- 
tions. It reports an agreement or a deviation, as the case may be, to the master, 
and sends a CAN message to the system with an error flag set, if necessary. 

The communication can take place by way of two lines, MATCH, MATCH_N, for 
example, which toggle in an opposite manner in every software loop and, in the 
event of errors, either both go to 1 or both go to 0. 

The signal processing unit (43, 31, 46) recognizes, through the acknowledgement 
noted above, that the signal processing unit (44, 32, 45) is available and is work- 
ing. 

The signal processing unit (44, 32, 45) recognizes, through the receipt of the CAN 
messages, that the signal processing unit (43, 31, 46) is available and is working. 



AP10890 



ABSTRACT^ 

A m e thod and a dev i c e for monitor i ng s i gna l 
process i ng un i ts for sensors 



The invention relates to a method and a device for monitoring signal processing units 
for sensors which detect the individual process control quantities or process measured 
values of a process. In order to improve the reliability of the sensor data of a vehicle, an 
at least redundant processing of the sensor data is carried out in two identical signal 
processing units (43, 31, 46; 44, 32, 45), which each have, independently and sepa- 
rately from the other, at least two processing devices (43, 44) in two evaluation devices 
(31, 32), whereby the sensor data are transmitted between the one processing device 
(43, 44) and the corresponding evaluation device (31, 32) through separate signal lines 
(60, 61). 



